Windows Event Log (EVT) - Revision history

Joachim Metz: /* Tools */

2013-03-27T07:24:17Z

‎Tools

Joachim Metz: /* External Links */

2013-02-09T07:04:51Z

‎External Links

Joachim Metz: /* See Also */

2013-02-09T06:56:53Z

‎See Also

Joachim Metz: /* External Links */

2012-10-24T21:22:35Z

‎External Links

Joachim Metz: /* Header Record */

2012-09-09T11:57:07Z

‎Header Record

Joachim Metz: /* External Links */

2012-09-09T11:55:09Z

‎External Links

Joachim Metz: /* External Links */

2012-09-09T11:54:54Z

‎External Links

Joachim Metz at 05:41, 11 August 2012

2012-08-11T05:41:08Z

Joachim Metz: moved EVT to Windows Event Log (EVT)

2012-07-21T09:04:26Z

moved EVT to Windows Event Log (EVT)

Joachim Metz at 09:04, 21 July 2012

2012-07-21T09:04:07Z

@@ Line 83: / Line 83: @@
 * [http://www.tzworks.net/prototype_page.php?proto_id=4 Windows Eventlog Viewer] Free tool that can be run on Windows, Linux or Mac OS-X. Parses Windows XP, Vista and Windows 7 eventlogs.
 * [[libevt]]
 [[Category:File Formats]]

@@ Line 68: / Line 68: @@
 == External Links ==
+=== File Format ===
 * [http://code.google.com/p/libevt/downloads/detail?name=Windows%20Event%20Log%20%28EVT%29.pdf Windows Event Log (EVT) format], by the [[libevt|libevt project]]
 * [http://eventid.net/ EventID.net]
 == Tools ==

@@ Line 65: / Line 65: @@
 == See Also ==
 * [[Windows XML Event Log (EVTX)]]
 == External Links ==

@@ Line 68: / Line 68: @@
 == External Links ==
-* [http://code.google.com/p/libevt/downloads/detail?name=Windows%20Event%20Log%20%28EVT%29.pdf Windows Event Log (EVT) format]
+* [http://code.google.com/p/libevt/downloads/detail?name=Windows%20Event%20Log%20%28EVT%29.pdf Windows Event Log (EVT) format], by the [[libevt|libevt project]]
 * [http://eventid.net/ EventID.net]

@@ Line 5: / Line 5: @@
 Each log file consists of a Header record and the Body. The body again consists of Event records, the Cursor record and unused space. The body could form a ring buffer, where the cursor record will mark the border between the oldest and the newest event record. Unused space could be empty, slack and padding.
-== [http://msdn.microsoft.com/en-us/library/bb309024%28VS.85%29.aspx Header] Record ==
+== Header Record ==
+The Header Record defined as [http://msdn.microsoft.com/en-us/library/bb309024%28VS.85%29.aspx ELF_LOGFILE_HEADER] on MSDN consists of:
 # uint32 length of record in bytes, fixed 0x30
 # char magic[4], fixed 'LfLe' (for Event log file)

← Older revision		Revision as of 11:54, 9 September 2012
Line 69:		Line 69:

	* [http://code.google.com/p/libevt/downloads/detail?name=Windows%20Event%20Log%20%28EVT%29.pdf Windows Event Log (EVT) format]		* [http://code.google.com/p/libevt/downloads/detail?name=Windows%20Event%20Log%20%28EVT%29.pdf Windows Event Log (EVT) format]
		+	* [EventID.net http://eventid.net/]

	== Tools ==		== Tools ==

← Older revision		Revision as of 05:41, 11 August 2012
Line 62:		Line 62:

	All of this means that EVT files aren't really complete on their own. The files which store the core meaning of the log entry are separate from the logs themselves and this creates several analysis problems. First of all, an attacker could modify DLLs or the registry in order to change the meaning of logs without having to touch the EVT file at all. Secondly, when software is uninstalled in the future, it could cause some EVT records to lose their context. Finally, EVT files aren't particularly portable to other systems, since some log records could rely on message templates which don't exist on other systems. One must be careful to keep these issues in mind when analyzing EVT logs.		All of this means that EVT files aren't really complete on their own. The files which store the core meaning of the log entry are separate from the logs themselves and this creates several analysis problems. First of all, an attacker could modify DLLs or the registry in order to change the meaning of logs without having to touch the EVT file at all. Secondly, when software is uninstalled in the future, it could cause some EVT records to lose their context. Finally, EVT files aren't particularly portable to other systems, since some log records could rely on message templates which don't exist on other systems. One must be careful to keep these issues in mind when analyzing EVT logs.
		+
		+	== See Also ==
		+	* [[Windows XML Event Log (EVTX)]]

	== External Links ==		== External Links ==

← Older revision		Revision as of 09:04, 21 July 2012
Line 1:		Line 1:
−	~~MS Windows Event Log Files~~
−
−
	MS Windows 2000, XP and 2003 typically maintain three Event Log files: Application, System, and Security. They are generally found in the C:\Windows\system32\config directory. Server versions of the OS may maintain additional Event Logs (DNS Server.evt, Directory Service.evt, File Replication Service.evt) depending upon the functionality of the server.		MS Windows 2000, XP and 2003 typically maintain three Event Log files: Application, System, and Security. They are generally found in the C:\Windows\system32\config directory. Server versions of the OS may maintain additional Event Logs (DNS Server.evt, Directory Service.evt, File Replication Service.evt) depending upon the functionality of the server.